fraud_reportswikiaorg-20200214-history
Canadian Health
Canadian Health&Care Mall is part of the Eva Pharmacy fraud. Description Each domain name resolves to an IP address of a hijacked host. Images loaded into web pages, as is common with Bulker.biz hijacked servers, are pulled down from a variety of other hijacked hosts. Each name server used to resolve the domain name to the IP address is also run on yet another hijacked host. Fake License 1 The actual Minnesota Board of Pharmacy has stated clearly that the license on this site is a fake, and even have a page devoted to Canadian Health&Care Mall on their websites's FAQ. They provided a statement to our investigators, pointing out all of the discrepancies in it. Comment from the Minnesota Board of Pharmacy: We are very much aware of this issue. It has been an ongoing issue for over a year. I have turned over information to our state's attorney general office and have had conversations with FDA investigators. The problem, as you are probably aware, is that it appears that whoever is behind this is operating outside the United States. The fake "license" shows clear indications that it is not valid. There are misspellings, sentences run together, Board of Pharmacy is not capitalized. Anyone who did some comparison shopping would also find that the websites charge several times more for drugs than legitimate websites. For example, tramdol sells for $0.64 on Walgreens.com but $2.17 on bestusdrugs.com. I will consider putting a statement on our website. Not sure what good it will do because I have a hunch that many people who actually try to purchase drugs from these websites already know they aren't legitimate - and don't care. As long as there are people willing to respond to spam that they know is illegitimate, the spammers will keep operating. Cody Wiberg, Pharm.D., R.Ph. Executive Director Minnesota Board of Pharmacy Fake License 2 Fake Doctors The "About Us" section of Canadian Health&Care Mall sites includes a heartwarming description of its beginnings as a "store of so-called 'useful things,'" written in rather clumsy English. They brag about selling "medication of the best possible quality, licensed and working." And since we've already seen what their license is worth, we conclude the likelihood of getting any drugs that work is ... ? Canadian Health&Care Mall started as a multistore based in Toronto and Ottawa in early 90s. Operating not just as a family pharmacy but also as a store of so- called "useful things" Health&Care chain store system grew from year to year and resulted in current online project. We tried to make use of our previous experience and to create a really competing online resource for absolutely any customer. Though the idea is standard you may be absolutely sure that the filling is unique and has no analogues all over the Internet. We would like to admit that our online store is operating independently from the offline store system. The site lists its medical staff as "Dr. Edward B. Armington" and "Dr. William Grant," both with impressive resumés. Apparently they and their team also have time on the side for modeling, as gettyimages.com is selling some of the same stock photos: These same fake credentials are found on the "Global Canadian Online" spam brand. This is a common trait across most of the Yambo Financials sites. My Canadian Pharmacy also uses stock photos as portraits of their so-called "physicians" and "staff." Fake Offices The "contacts" page includes addresses for offices in Ontario, Louisiana, and New Delhi, as well as photos of the buildings they claim to occupy at those locations. They even offer to provide a "face to face audience" with one of their managers to anyone who wishes to visit them on site. But comparing the buildings in the photos to Google Maps satellite images of those addresses shows residential areas with no sign of large buildings like these: In more recent sites, the same building has been teleported to Kingston, ON, Canada: The address in Waterloo, ON turns out to be a residential neighborhood: The third location, an address in New Delhi, is too inexact for Google maps to locate it; it is unclear if such an address actually exists. Fake VeriSign certificate Fake FDA certificate Fake Security Some sites have an SSL certificate to encrypt the transmission of sensitive daata such as credit card information, others do not. In either case the site claims to provide encryption with a 256-bit level. Here is an example of a false claim. On the right is a padlock icon representing an encrypted link, together with a false claim to be using encryption. On the left, the browser reveals the true status - no encryption image:CHCM.SLSS.jpg Fake Registration Like other Yambo family sites, CH&CM uses identity theft to register its sites. Victims whose personal information has been used to register one of these sites should follow the steps outlined here. In 2014 the method changed from using stolen identities, to using a fake name generator service, such as the one found at http://www.fakenamegenerator.com. These fake ID sites will generate real looking names, addresses, phone numbers and credit cards to simulate real identities. The aim is to make it more difficult for registrars to identify fake registrant data. Only the email address will be true, so that the registrant can handle information requests from the registrars. Sample Spam Hi there, this is your chance to Heal your healt! We have various medicament that will assistance you For the real men we have our special proposal Just CLICK here! Come on start a new life with our medicament!!! As our customer you have a chance to check out first to anybody our new page! Only primal high-grade pharmaceutics at a price you can afford!! 20% guaranteed reduction is for you only!!! Take notice what said our pleased clients: From: Brian Zalewski Subject: Simply Thank you! "Thank you very much you rendered me festal rebates & your special offers that preserve time and greens, offering only medicinal agents of highest quality. You're of my minions, I shall tell about your drugstore without fail all my buddies!" Note some more testimonials at our site! Sample sites and registrars who were sponsoring them ARDIS-REG-FID bestsupport.su suspended serviceim.su suspended startfbiz.su suspended BIZCN.COM, INC. curingmedicaretrade.com canadianhotvalue.com fasttabsshop.xyz globalwelnessvalue.com healingaidstore.be safeonlineshop.xyz safetabletelement.be tvlshuoj.com yourpharmvalue.xyz GKG.NET, INC. prosales24x7.com Key-Systems GmbH anastassiajill.be andietovevilma.be angiecolly.eu bevvybriana.eu britneyalameda.be carrollmorganne.be coleenbren.be dalennadorree.eu desirieulalie.be eustaciabunny.be fastnaturalvalue.eu fernandegabie.be fredjanith.be freidaclaire.be gerrieevvy.be goodglobalsale.eu goodpillsservices.be hortensiarosalie.be inessanadya.eu janeendinajolie.be jerryleemisti.be juanitaromonda.be kittyalissa.be lianshanda.be lorindakayle.eu lydiatierney.be margalobeatrix.eu margeryaprilette.be meggieemilie.be moniquebrier.be moreenpansie.eu mysafeinc.eu nanitrudey.be ninettayoshi.eu noamiadena.eu patriziabertine.be pureaidpurchase.be ritakendre.be shainafredia.be sibleyjyoti.be sissyverla.be staceelonee.eu stephanihattie.eu tessymadeline.be vitadorthea.eu vittoriasamneilla.eu NAMESILO, LLC excellentherbsale.com suspended naturalhotquality.com suspended NANJING IMPERIOSUS TECHNOLOGY CO. LTD. canadianstorechcm.com NETLYNX, INC. medicatingsafestore.in PDR Ltd. familyhotdeal.click R01-RU alliemanonjosi.ru arbjubfn.ru bestaidassist.ru bestbestpurchase.ru bestcareassist.ru bestcurativemart.ru bestdrugsbargain.ru bestfirsttrade.ru bestmedicareassist.ru bestmedsprogram.ru bestmedstrade.ru bestpillgroup.ru biologicalsecureinc.ru bodymagicpillquality.ru btgsorwb.ru canadiancaremall.ru canadianfamilysale.ru canadianrxquality.ru canadianrxsale.ru canadiansafesale.ru clariphyllida.ru curativefirstsupply.ru curativefirsttrade.ru curativemedicareassist.ru curativeonlineinc.ru curativeonlinesale.ru curativepillmart.ru curativesecuredeal.ru curativesecuregroup.ru curativesmartgroup.ru curingaidprogram.ru curingdrugsdeal.ru curingfamilymall.ru curingfamilytrade.ru curinggenericsvalue.ru curinghotshop.ru curingonlinedeal.ru curingonlineservice.ru curingprivateinc.ru curingremedymarket.ru curingrxquality.ru curingtrustedstore.ru curingwelnesssale.ru edzojbys.ru emjfawef.ru excellentcareeshop.ru excellentcurativevalue.ru excellentpharmeshop.ru excellentrxgroup.ru fabhymzv.ru familydrugsreward.ru familydrugvalue.ru familyherbalbargain.ru familyherbmarket.ru familyherbsupply.ru familyherbsvalue.ru familyprivatesale.ru familytabsstore.ru fastaidquality.ru fastaidsale.ru fastaidvalue.ru fastcanadianassist.ru fastcarecompany.ru fastcareelement.ru fastcaresupply.ru fastcuringsale.ru fastmedicatingtrade.ru fastmedsassist.ru fastmedsinc.ru fastmedsquality.ru fastmedsservices.ru fastpharmvalue.ru fastpharmwebmart.ru fastremedialbargain.ru fastremedialprogram.ru fastsafewebmart.ru firstdrugsservices.ru firstfastdeal.ru firstmedicamentcompany.ru firstmedicamentdeal.ru firstmedicamentmart.ru firstmedicativedeal.ru firstmedsshop.ru firstorganicbargain.ru firstpharmacysale.ru firstremedytrade.ru etc REGTIME-REG-FID bestmylife.su webgeostart.su TUCOWS DOMAINS INC. privatepillpurchase.com suspended puresmartsupply.com suspended familytabsvalue.com pureprivatesale.com History History of the Spam - followed on from My Canadian Pharmacy In the past they have used the same process of running its name servers, web site servers and image servers on hijacked hosts. For example, examining the html source of a sample web page at any one time will have found src="http://82.240.202.162:8080/e/ch/images/spacer.gif" src="http://201.28.121.171:8080/e/ch/images/aw_verisign.gif" src="http://217.6.21.195:8080/e/ch/images/aw_fda.gif" src="http://148.223.209.19:8080/e/ch/images/aw_cpa.gif" src="http://142.217.131.166:8080/e/ch/images/aw_aq.gif" for a web site running on 222.161.21.110 The four name servers are meanwhile running on 200.62.226.85 and 80.191.123.206 In total there were 8 different IP addresses involved, all running a trojan proxy name server or web server without their owners' consent. This method has now been abandoned after a comcerted campaign to report these hijacked hosts and to have them cleaned. Look-alike sites MycanadarxStore appeared in late October 2007. Its "about us" section is highly similar to that of Canadian Health&Care Mall, including the photos of "Dr. Edward B. Armington" and "Dr. William Grant." However, it differs from the other Yambo sites in that it does not share the image server IP address(es) they all use. It shares its nameservers with Prestige Replicas, not any Yambo sites. So this appears to be a case of plagiarism rather than affiliation. How to Report this Spam Sponsor Organization Bulker.biz is the sponsor organization behind this type of site. They pay spammers to promote it, and they don't shut down illegal spammers. Related Spams * Dr.Pills Related spam operations See: Category:Yambo family Further Reading LegitScript report, May 2010 Category:Well-known Spam Category:Bulkerbiz Spam Category:Yambo family Category:Pharma spam